Loading vulnerability…
Remote Code Execution in Gitea diffpatch API via Git Hook Installation
CVE-2026-60004 is a critical code-injection vulnerability affecting Gitea versions 1.17 through 1.27.0. The diffpatch API processes attacker-controlled patches in a shared temporary bare Git clone. Repeated submission of a crafted patch abuses Git's three-way merge fallback to write an executable Git hook into the clone's active hook directory despite cached patch processing. A subsequent Git index operation invokes the hook, executing arbitrary commands as the Gitea operating-system service account. Exploitation requires repository write access, but deployments permitting self-registration and repository creation can allow attackers to obtain that access without pre-existing credentials. The vulnerability is actively exploited and is fixed in Gitea 1.27.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of resources accessible to the Gitea service account. Attackers can steal or modify repositories, access application configuration, database contents, environment variables, tokens, SSH keys, and integration credentials, and deploy persistent backdoors or resource-consuming malware. Observed exploitation has included source-code and credential theft, cryptocurrency mining, persistence, and lateral movement. Access to additional infrastructure depends on exposed credentials, service-account permissions, and network reachability; root-level access is not an inherent result of this vulnerability.
If you can’t patch tonight, do this now.
Until an upgrade is possible, disable or block the diffpatch route at a reverse proxy or otherwise restrict access to it. Disable unnecessary public registration, restrict repository creation and write permissions to trusted users, and limit Gitea access to trusted networks or a VPN. Disabling registration alone does not protect against existing or compromised repository writers. Run Gitea under a dedicated least-privileged service account and, where operationally feasible, prevent execution from temporary clone storage. Monitor for paired diffpatch submissions, unexpected Git-hook activity, service-account shell processes, unusual outbound connections, and sustained CPU consumption.
Patch, then assume compromise.
Upgrade affected Gitea installations to version 1.27.1 or later. The fix replaces the vulnerable temporary bare clone with a non-bare clone, preventing patch-controlled files from being placed in the active Git hook directory through this workflow. Investigate previously exposed installations even after patching: review account and repository creation, diffpatch activity, Git hooks, unexpected service-account processes, and unauthorized repository changes. If compromise is suspected, rotate accessible passwords, tokens, SSH keys, and integration secrets. Rebuild confirmed infected hosts from trusted images rather than relying on live malware removal.
14 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
203 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.